The latest released 0.x version receives fixes. Until a 1.0.0 release, only the most recent minor version is supported.

Please do not open a public issue for security problems.

Report vulnerabilities privately via GitHub's private vulnerability reporting ("Report a vulnerability" on the repository's Security tab). Include a description, affected versions, and a minimal reproduction if possible.

You can expect an acknowledgement within a few days. Once a fix is available it will be released and the advisory published with credit to the reporter (unless anonymity is requested).